Description

Detects when Flask applications are configured to run in debug mode in production environments. Debug mode exposes sensitive internal information and allows remote code execution through the debugger, making it a critical security risk if enabled in production.

Detection Strategy

• Looks for '.run()' calls on any variable bound to a Flask instance, resolving flask imports and aliases

• Checks if debug parameter is explicitly set to True in the run configuration

• Reports a vulnerability when debug mode is enabled in Flask application code

• Skips files that do not import Flask

Vulnerable code example

from flask import Flask

app = Flask(__name__)

DEBUG_MODE = True  # Dangerous: Debug mode should never be enabled in production

app.run(debug=DEBUG_MODE)  # Vulnerable: Exposes debugger with code execution

✅ Secure code example

from flask import Flask
from typing import Final

app: Flask = Flask(__name__)

DEBUG_MODE: Final = False  # Security: Debug mode disabled for production

@app.route("/")...